Generate an Azure Application Gateway self-signed certificate with a custom root CA

https://slproweb.com/products/Win32OpenSSL.html

  download 32 bit.
then follow below link:-
https://docs.microsoft.com/bs-latn-ba/azure/application-gateway/self-signed-certificates

at section Generate the certificate with the CSR and the key and sign it with the CA’s root key

 instead of

openssl x509 -req -in fabrikam.csr -CA public.crt -CAkey contoso.key -CAcreateserial -out fabrikam.crt -days 365 -sha256

 use this
openssl x509 -req -in fabrikam.csr -CA contoso.crt -CAkey contoso.key -CAcreateserial -out fabrikam.crt -days 365 -sha256

then use below to merge fabrikam.key + fabrikam.crt to fabrikam.pfx

Refer blog

https://www.ssl.com/how-to/create-a-pfx-p12-certificate-file-using-openssl/

command:-
openssl pkcs12 -export -out fabrikam.pfx -inkey fabrikam.key -in fabrikam.crt

and

openssl pkcs12 -export -out contoso.pfx -inkey contoso.key -in contoso.crt

then continue with
https://docs.microsoft.com/bs-latn-ba/azure/application-gateway/self-signed-certificates

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

openssl ecparam -out rakeshca.key -name prime256v1 -genkey

openssl req -new -sha256 -key rakeshca.key -out rakeshca.csr

openssl x509 -req -sha256 -days 365 -in rakeshca.csr -signkey rakeshca.key -out rakeshca.crt

~~~~~ server certificate  named rakeshdevops.com issuer is  rakeshca~~~~~~~~~~~

openssl ecparam -out rakeshdevops.key -name prime256v1 -genkey

openssl req -new -sha256 -key rakeshdevops.key -out rakeshdevops.csr

openssl x509 -req -in rakeshdevops.csr -CA  rakeshca.crt -CAkey rakeshca.key -CAcreateserial -out rakeshdevops.crt -days 365 -sha256

openssl x509 -in rakeshdevops.crt -text -noout

Export:-

openssl pkcs12 -export -out rakeshdevops.pfx -inkey rakeshdevops.key -in rakeshdevops.crt

~~~~~other server certificate  named punamdevops.com issuer is  ~~~~~~~~~~~~~~~~~rakeshca~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

openssl ecparam -out punamdevops.key -name prime256v1 -genkey

openssl req -new -sha256 -key punamdevops.key -out punamdevops.csr

openssl x509 -req -in punamdevops.csr -CA  rakeshca.crt -CAkey rakeshca.key -CAcreateserial -out punamdevops.crt -days 365 -sha256

openssl x509 -in punamdevops.crt -text -noout

 Export:-

openssl pkcs12 -export -out punamdevops.pfx -inkey punamdevops.key -in punamdevops.crt

openssl pkcs12 -export -out rakeshca.pfx -inkey rakeshca.key -in rakeshca.crt

openssl s_client -connect localhost:443 -servername www.rakeshdevops.com -showcerts

How to ensure Compliance with Azure Policies

Azure Policy service with real world example

Azure Policy is a service in Azure that you use to create, assign, and manage policies. These policies enforce different rules and effects over your resources, so those resources stay compliant with your corporate standards and service level agreements. Azure Policy meets this need by evaluating your resources for non-compliance with assigned policies. For example, you can have a policy to allow only a certain SKU size of virtual machines in your environment. Once this policy is implemented, new and existing resources are evaluated for compliance. With the right type of policy, existing resources can be brought into compliance.

We will create real Azure resources, assign real auditable flags (in the form of Azure tags), and then create a policy to prove the audit state of the objects with Azure policy reporting.

Create Two Virtual Networks

1.    Create the first virtual network.

·         The name can be anything ("HubvNet1" in this example).

·         The primary address space should 10.0.0.0/24.

·         The subnet address range should be 10.0.0.0/26.

2.    Create a second virtual network.

·         The name can be anything ("SpokeVnet1" in this example).

·         The primary address space should 10.10.10.0/24.

·         The subnet address range should be 10.10.10.0/26.

Create a Tag for Each Virtual Network

1.    Add a tag to HubvNet1.

·         Name: Audit

·         Value: Yes

2.    Add a tag to SpokeVnet1.

·         Name: Audit

·         Value: No

Create a Policy

     in the case of the subscriptions and resource groups, the only available option.

1.    Create a policy> Compliance > Assign Policy

2.    Narrow the scope to our resource group.

Go to BASIC and click on rectangle button

3.    Search "Tag" in the available policy definitions list.

4.    Choose Require tag and its value.

5.    Set a Tag Name of Audit and Tag value to Yes

7.    After 15–30 minutes, narrow the scope of the Compliance blade to the resource group, and it should refresh to show the policy as non-compliant: 50%.

Securing a Virtual Network with Azure Firewall

                            Securing a Virtual Network with Azure Firewall

KB2919355 Check Failed. If you have installed KB2919355 on Windows Server 2012 for SQL Server 2017 installation

in some Windows Server  2012 R2, when you install SQL Server 2017 developer/enterprise  edition
The validation check gets fail.


Issue:-

---------------------------
Rule Check Result
---------------------------
Rule "KB2919355 Installation" failed.

KB2919355 Check Failed. If you have installed KB2919355, please make sure you have restarted your machine. For more information, you can visit https://support.microsoft.com/kb/2919355/
---------------------------
OK 
---------------------------

Resolution:-

In order to resolve this error..

you have to do the following

First go ahead and download this KB -- Windows8.1-KB2919442-x64 and install

Then download   Windows8.1-KB2919355-x64 and then install. 

Please note installation of Windows8.1-KB2919355-x64 will take some time.

Thanks for reading..

Failed to save Transparent Data Encryption settings for SQL resource

Failed to save Transparent Data Encryption settings for SQL resource: myserver0102. Error message: The provided Key Vault URI 'https://mypersonalXXXXvault01.vault.azure.net/keys/XXXXXX/283d045477e04fdab5c0055be37c0eee' is not valid. Please ensure the key vault has been configured with soft-delete.


in order to solve this issue.. go to cloud shell and execute below command




($resource = Get-AzResource -ResourceId (Get-AzKeyVault -VaultName "mypersonalXXXXvault01").ResourceId).Properties | Add-Member -MemberType "NoteProperty" -Name "enableSoftDelete" -Value "true"

Set-AzResource -resourceid $resource.ResourceId -Properties $resource.Properties


and you are done.

This issue will get resolved. 

Different components of application gateway

    Different Components of Application Gateway 

Application gateway and its different capabilities.
Application gateway offers layer 7 load balancing capabilities for HTTP and HTTPs traffic.

 and when you compare the application gateway with the

load balancer, Load balancer offers layer 4 load balancing capabilities.

Whereas application gateway offers layer 7 load balancing capability.

However the load balancer can distribute different type of traffic whereas application gateway can distribute only HTTP and HTTPs traffic.

And one other difference between External load balancer and application gateway is application gateway always resides within the virtual network whereas load balancer you can choose whether it should be inside virtual network or outside virtual network.


And in terms of components of application gateway,
1.FrontEnd IP Configuration --> Application gateway  has a frontend IP configuration.
They are basically IP addresses to which the traffic will come to.
2.Backend pool ---> which basically contains pool of IP addresses where the traffic
will be destined to.
3.listeners--> Listeners are basically listens to the traffic that is coming to a particular port.
In this case either 80 or 443 for HTTPs traffic and rules are something that will map this listeners to the backend pool. So it will basically map the incoming traffic to a particular destination pool
4.Health probe--> which will basically monitor the health of the backend pool machines
5.HTTP settings which will define whether we should use cookie based session affinity or which  port in the backend pool that the traffic needs to be routed to and all those stuff.
6.web application firewall which can be used to protect your web application from some
common web attacks.

So these are the components of application gateway.

Let's go through some of the capabilities of application gateway.
 In terms of capabilities,
Capabilities

1. HTTPS Load Balancing -- It can load balance HTTP or HTTPs traffic
2. Web Application Firewall -- web application firewall to protect your web application against common web attacks
3. Cookie based Session affinity -- you can use cookie based session infinity in order to route all the user session traffic to a particular backend server throughout the user session.
4. SSL offload-- If you want to offload the SSL traffic at the application gateway level you can configure the application gateway to achieve it.
5. URL based content routing->If you want to route your traffic based on the URL then you'll be able to do the same using application gateway.
6. Multi-site routing -> if you want to host multiple sites on a single public IP address you can achieve the same using application gateway. Basically you can configure the application gateway in such a way based on the domain name.It will route the traffic to a particular backend pool.
7. Health monitoring you can monitor the health of your backend virtual machines by configuring a health probe in application gateway.

So these are the different capabilities of application gateway.

Autoscaling public preview

In addition to the features described in this article, Application Gateway also offers a public preview of a new SKU [Standard_V2], which offers auto scaling and other critical performance enhancements.

Autoscaling - Application Gateway or WAF deployments under the autoscaling SKU can scale up or down based on changing traffic load patterns. Autoscaling also removes the requirement to choose a deployment size or instance count during provisioning.

Zone redundancy - An Application Gateway or WAF deployment can span multiple Availability Zones, removing the need to provision and spin separate Application Gateway instances in each zone with a Traffic Manager.

Static VIP - The application gateway VIP now supports the static VIP type exclusively. This ensures that the VIP associated with application gateway does not change even after a restart.

Faster deployment and update time as compared to the generally available SKU.

5X better SSL offload performance as compared to the generally available SKU.

Demo
1.How to load balance HTTP traffic using Application Gateway.
https://docs.microsoft.com/en-us/azure/application-gateway/quick-create-portal
2.How to configure application gateway to achieve URL based content routing.
https://docs.microsoft.com/en-us/azure/application-gateway/application-gateway-create-url-route-portal
3.How to configure Application gateway for hosting multi site routing
4. How to Enable web application firewall on a Application Gateway and Simulate an Attack

to check whether your web application firewall is securing your web application against excesses attacks etc..

Scripts to configure Application gateway using Terraform <Coming soon>

Connect on Premise Network to Azure - Site to Site VPN Configuration using PowerShell

Login-AzureRmAccount


#create our base variables for our Resource Group
$rgName="RakAzureDC"
$locName="West Europe"
$saName="rakserverssa" #must be lower case
$vnetName="RakoNetAzure"

New-AzureRmResourceGroup -Name $rgName -Location $locName

 #Test-AzureName -Storage $saName

$saType="Standard_GRS"

New-AzureRmStorageAccount -Name $saName -ResourceGroupName $rgName –Type $saType -Location $locName

#Create Networking Components
#It's important to create one subnet named specifically GatewaySubnet. If you name it something else, our connection configuration will fail.
$Subnet=New-AzureRmVirtualNetworkSubnetConfig -Name Azure-Vnet-01 -AddressPrefix 10.10.10.0/27
$GatewaySubnet = New-AzureRmVirtualNetworkSubnetConfig -Name 'GatewaySubnet' -AddressPrefix 10.10.10.32/29
New-AzureRmVirtualNetwork -Name $vnetName -ResourceGroupName $rgName -Location $locName -AddressPrefix 10.10.10.0/24 -Subnet $Subnet,$GatewaySubnet -DnsServer 10.10.10.4,192.168.1.10

Get-AzureRmVirtualNetwork  -name $vnetName -ResourceGroupName $rgName | select subnets

$subnetIndex=0
$vnet=Get-AzureRmVirtualNetwork -Name $vnetName -ResourceGroupName $rgName

$nicName= "Internal"
$staticIP="10.10.10.4"

#add a public IP address via $pip so we can connect to it if we need to
$pip = New-AzureRmPublicIpAddress -Name $nicName -ResourceGroupName $rgName -Location $locName -AllocationMethod Dynamic
$nic = New-AzureRmNetworkInterface -Name $nicName -ResourceGroupName $rgName -Location $locName -SubnetId $vnet.Subnets[$subnetIndex].Id -PublicIpAddressId $pip.Id -PrivateIpAddress $staticIP





# don't know what VM sizes we have, so lets take a look
Get-AzureRmVMSize -Location $locName | Select Name

#name and size our Domain Controller
$vmName="AZURE-DC01"
$vmSize="Standard_A2"
$vm=New-AzureRmVMConfig -VMName $vmName -VMSize $vmSize


$pubName="MicrosoftWindowsServer"
$offerName="WindowsServer"
$skuName="2012-R2-Datacenter"


$cred=Get-Credential -Message "Type the name and password of the local administrator account."
$vm=Set-AzureRmVMOperatingSystem -VM $vm -Windows -ComputerName $vmName -Credential $cred -ProvisionVMAgent -EnableAutoUpdate
$vm=Set-AzureRmVMSourceImage -VM $vm -PublisherName $pubName -Offer $offerName -Skus $skuName -Version "latest"
$vm=Add-AzureRmVMNetworkInterface -VM $vm -Id $nic.Id
$diskName="OSDisk"
$storageAcc=Get-AzureRmStorageAccount -ResourceGroupName $rgName -Name $saName
$osDiskUri=$storageAcc.PrimaryEndpoints.Blob.ToString() + "vhds/" + $diskName + ".vhd"
$vm=Set-AzureRmVMOSDisk -VM $vm -Name $diskName -VhdUri $osDiskUri -CreateOption fromImage
New-AzureRmVM -ResourceGroupName $rgName -Location $locName -VM $vm

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


#####################
#Provision Network




#add our local Network site
#Name Nickname for our on-premises network
#NewGatewayIPAddress is the IP address of your on-premises VPN
#AddressPrefix is your on-premises address space.


New-AzureRmLocalNetworkGateway -Name RakNetOnPremises -ResourceGroupName $rgName -Location $locName -GatewayIpAddress '122.167.33.81' -AddressPrefix '192.168.1.0/24'


#request a public IP address for the gateway

$gwpip= New-AzureRmPublicIpAddress -Name gwpip -ResourceGroupName $rgName -Location $locName -AllocationMethod Dynamic

#create the gateway IP addressing configuration

$vnet = Get-AzureRmVirtualNetwork -Name $vnetName -ResourceGroupName $rgName
$subnet = Get-AzureRmVirtualNetworkSubnetConfig -Name 'GatewaySubnet' -VirtualNetwork $vnet
$gwipconfig = New-AzureRmVirtualNetworkGatewayIpConfig -Name gwipconfig1 -SubnetId $subnet.Id -PublicIpAddressId $gwpip.Id

#create the gateway - may wait a while

New-AzureRmVirtualNetworkGateway -Name vnetgw1  -ResourceGroupName $rgName -Location $locName -IpConfigurations $gwipconfig -GatewayType Vpn -VpnType RouteBased

#https://azure.microsoft.com/en-us/documentation/articles/vpn-gateway-create-site-to-site-rm-powershell/#7-configure-your-vpn-device

#Get the public IP address for the next step of building our connection script for RRAS either via powershell or via the Portal

Get-AzureRmPublicIpAddress -Name gwpip -ResourceGroupName $rgName


#BUILD our RRAS Configuration

$gateway1 = Get-AzureRmVirtualNetworkGateway -Name vnetgw1 -ResourceGroupName $rgName

$local = Get-AzureRmLocalNetworkGateway -Name RakNetOnPremises -ResourceGroupName $rgName

New-AzureRmVirtualNetworkGatewayConnection -Name RakoToAzureVPN -ResourceGroupName $rgName -Location $locName -VirtualNetworkGateway1 $gateway1 -LocalNetworkGateway2 $local -ConnectionType IPsec -RoutingWeight 10 -SharedKey 'abc123'

Now you need to configure RRAS Server

After configuration of RRAS Server, try to connect.